Österreichische Post: no compensation without damage, but no seriousness threshold for non-material damage

What it is about

Question: does every GDPR infringement give a right to compensation, and may national law require non-material damage to reach a certain seriousness? Ruling: a mere infringement is not enough; there must be damage caused by the infringement. National law may not, however, require non-material damage to reach a seriousness threshold. The amount of compensation is set by national rules, provided equivalence and effectiveness are respected.

What this means in practice

Expect claims for non-material damage after data breaches and other infringements, including for relatively minor effects such as anxiety or loss of control; the argument that the harm is simply too minor to count does not work on its own. The claimant must still prove actual damage and a causal link. Therefore document incidents and your response carefully so you can contest damage and causation where that is justified.

The GDPR articles concerned

• Article 82: Right to compensation and liability